Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw

On 20 and 21 October, an attacker attempted to exploit CVE-2026-97229 against Alpine Linux’s GitLab instance. The flaw, rated CVSS 10.0, could allow remote code execution and arises from a specially crafted regular expression in a CI/CD configuration affecting Onigmo, Ruby’s regexp engine. Alpine states the attacker used crafted CI configurations against an unpatched GitLab server; while Alpine says the attack “came close to working,” there was no proof of full success, and the server is treated as compromised.

Alpine also notes the attacker downloaded Alpine’s GitLab container image, suggesting the exploit was being tuned to Alpine’s exact build. The CVE-2026-97229 is not listed in CISA KEV at the time of report, and Pro/Team adds an additional confirmed-exploit feed.

Affected versions include GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; self-built GitLab instances using Ruby older than 3.3.13, 3.4.12 or 4.0.9; and alpinelinux/gitlab images pulled before 27 October. The recommended remediation is to upgrade GitLab to 19.2.8, 19.3.5 or 19.4.2, and, if using your own Ruby, install Ruby 3.3.13, 3.4.12, or 4.0.9 or later. Alpine also reset GitLab passwords and replaced secret keys, and urges users to change reused passwords elsewhere.

The report attributes these observations to Alpine Linux and GitLab teams, with confirmation that exploitation targeted an unpatched server and that patches involve updates to Ruby as part of the GitLab fix.